From 75f032153cfa1350d6bdf074718f7101354f3dcc Mon Sep 17 00:00:00 2001 From: Zvonko Kaiser Date: Mon, 13 Jul 2026 20:54:30 +0000 Subject: [PATCH] hypervisor/qemu: note seccomp sandbox as Phase 3 consideration seccompsandbox already maps to -sandbox in cmdline_generator.rs via seccomp_sandbox: Option in HypervisorConfig. When Platform takes over argument emission in Phase 3, sandbox support needs a typed Objects::seccomp_sandbox field so the legacy generator can be removed cleanly. Assisted-by: Claude Sonnet 4.6 Signed-off-by: Zvonko Kaiser --- src/runtime-rs/crates/hypervisor/src/qemu/ARCHITECTURE.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/runtime-rs/crates/hypervisor/src/qemu/ARCHITECTURE.md b/src/runtime-rs/crates/hypervisor/src/qemu/ARCHITECTURE.md index 0741d7fe3f..8aa50305e0 100644 --- a/src/runtime-rs/crates/hypervisor/src/qemu/ARCHITECTURE.md +++ b/src/runtime-rs/crates/hypervisor/src/qemu/ARCHITECTURE.md @@ -644,6 +644,11 @@ Final PR in Phase 2: remove all remaining `#[cfg(target_arch)]` blocks from `MemoryBackend::File`. - Wire hugepages via `Platform::with_hugepages`. - Lift `ObjectIoThread` / `ObjectRngRandom` into `Objects`. +- Consider wiring `seccompsandbox` (QEMU `-sandbox`) through `Platform`: + the config field `seccomp_sandbox: Option` already maps to + `-sandbox` in `cmdline_generator.rs`, but the new path needs a typed + `Objects::seccomp_sandbox: Option` so the emission + is controlled by `Platform` rather than the legacy generator. This is the phase that enables hugepages for `runtime-rs` (issue #12125).